PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
The U.S. National Security Agency (NSA) issued a warning on Wednesday about critical security flaws discovered in PHP, a widely-used server-side programming language that powers roughly 70% of the websites on the internet. These vulnerabilities, which have been present in PHP since its version 5 release in 2004, allow attackers to infiltrate the server's file system or databases.
The NSA advises that if a website cannot be patched immediately, it should be taken offline until a solution is implemented. Patches were issued by the PHP Foundation, and web servers should be updated to the latest version (8.5.12). OpenAI and Google's Wiz used AI to uncover the flaws, working with PHP to develop and test the patches.
Both organizations followed responsible security research practices, disclosing the vulnerabilities before hackers could exploit them, thanks in part to AI's ability to adapt exploits across different PHP versions and configurations. Now that the issue has been disclosed, the internet faces a race against time to patch the estimated tens of millions of affected websites before hackers can exploit the unpatched ones.
The NSA has warned that if immediate patching is not possible, it is better to take affected sites offline until the vulnerabilities are resolved.
Written by urgent.news from TechCrunch's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
